Developer tool
DNS, SSL and Security Header Checker
Look up A, AAAA, MX, TXT, NS, CNAME and CAA records, inspect the SSL certificate chain and expiry, and grade HTTP security headers with fix hints.
Our server runs the lookups for you against the domain you enter, using public DNS and a connection to its HTTPS port. Nothing is stored.
How to use the dns, ssl and security header checker
Three checks every site owner should run
When a site is slow to set up, shows a browser warning or gets flagged in a security scan, the cause is usually one of three things: DNS, the certificate, or missing headers. This tool checks all three for a public domain in one go.
How to use it
- Enter a domain such as example.com. A full URL also works; only the host name is used.
- Press Check. The results appear in three sections.
- Work through the red and amber items first.
DNS records
You get A and AAAA (IPv4 and IPv6 addresses), CNAME aliases, MX mail servers with priority, NS name servers, TXT records (SPF, DKIM, verification codes), CAA records that limit who may issue certificates, and the SOA record with the zone serial. Use it to confirm a change after pointing a domain to a new host, or to check that your SPF record exists.
SSL certificate
The tool connects to port 443 and shows the protocol (TLS 1.2 or 1.3), who issued the certificate, the names it covers, the validity dates and the days left. It warns when the certificate expires within 30 days or has already expired, and lists the chain so you can spot a missing intermediate.
Security headers
Your home page is requested once and each header is graded: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the cross-origin policies. Every row includes the problem and a ready-to-paste fix. You also get an overall grade from A+ to F.
Fixing common findings
- No HSTS: add Strict-Transport-Security with a one-year max-age once HTTPS works everywhere.
- Certificate expiring: renew it and enable automatic renewal at your host or with a client such as certbot.
- No CSP: start in report-only mode, then enforce it.
- Missing CAA: add a record naming your certificate authority.
Limits
The check covers one host name and one request. It cannot see headers on other pages, internal services or anything behind a login, and headers sent only to some user agents may differ.
Frequently asked questions
What does the tool check?
It looks up the A, AAAA, CNAME, MX, NS, TXT, CAA and SOA records, connects to port 443 to read the certificate chain, protocol and expiry date, and requests the home page to grade the HTTP security headers.
Can it check an internal or IP address?
No. Only public domain names are accepted. IP addresses, localhost and private or reserved ranges are refused, and the certificate check connects only to the validated public address the name resolves to.
Why does it still show a certificate that fails validation?
On purpose. An expired, self-signed or mismatched certificate is exactly what you want to see, so the tool reports it along with the validation error instead of stopping.
How is the header grade calculated?
Each header has a weight: CSP and HSTS count most, then the framing, content type, referrer, permissions and cross-origin headers. A header that is present and strong earns full points, a weak value earns part, and a missing one earns none.
Why are some DNS records empty?
Most domains only have some record types. An empty list means the name has no record of that type. A "timed out" label means the resolver did not answer within a few seconds; try again.
Is the DNS data live or cached?
It is answered by the resolver our server uses, so it can be cached for the length of each record's TTL. After a DNS change you may need to wait for the old TTL to expire.